Sample policy · IPC Code

Infection prevention and control policy template

Statutory anchor: Regulation 12 (safe care and treatment), Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 (SI 2014/2936), in particular Regulation 12(2)(h) on infection prevention and control. This policy also engages Regulation 15 (premises and equipment) and Regulation 17 (good governance), and has regard to the Health and Social Care Act 2008 Code of Practice on the prevention and control of infections (issued under Section 21). · primary source

Download the PDF

The PDF version of this template is the same content, formatted for adaptation in your document control system. The disclaimer above is repeated on the PDF cover.

Download PDFTalk to a consultant

Verivius pack version v1, 2026-06-10

1. What the regulation says

Care and treatment must be provided in a safe way for service users. (Reg 12(1) (the headline duty))

assessing the risks to the health and safety of service users of receiving the care or treatment, (Reg 12(2)(a) (risk assessment))

doing all that is reasonably practicable to mitigate any such risks, (Reg 12(2)(b) (risk mitigation))

assessing the risk of, and preventing, detecting and controlling the spread of, infections, including those that are health care associated, (Reg 12(2)(h) (infection control))

The full text of the regulation is at https://www.legislation.gov.uk/uksi/2014/2936/regulation/12. Where this policy and the regulation diverge, the regulation wins.

2. Plain-English summary

Care and treatment must be provided in a safe way. The regulation lists the areas a provider must address, including risk assessment, risk mitigation, staff competence, safe premises, safe equipment, sufficient equipment and medicines, medicines safety, infection prevention and shared-care planning. Regulation 12 is central to CQC's safety expectations.

Infection prevention and control sits squarely within Regulation 12(2)(h). The Health and Social Care Act 2008 Code of Practice on the prevention and control of infections is issued by the Secretary of State under Section 21 of the Health and Social Care Act 2008. Although the Code itself is not statute, providers must have regard to it, and the Care Quality Commission takes the Code into account in registration and inspection. The Code is operationally enforceable via Regulations 12 (safe care and treatment), 15 (premises and equipment) and 17 (good governance) of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014. The Code sets out ten compliance criteria covering: systems to manage IPC; clean and appropriate environment; antimicrobial stewardship; service-user information; prompt identification of people at risk of infection; care-worker awareness and responsibility (including contractors and volunteers); isolation facilities; laboratory access; care policies; and staff health and wellbeing. The current version of the Code was last updated by the Department of Health and Social Care on 13 December 2022.

3. Scope

This policy applies to all employees, contractors, volunteers, and external parties who deliver, support, or oversee any regulated activity at . It covers every clinical and clinical-adjacent environment (consulting rooms, theatres, wards, recovery, decontamination rooms, mobile delivery, vehicle interiors where patients are transported), every clinical procedure (invasive, non-invasive, point-of-care), and every shared building service (laundry, waste, ventilation, water systems).

(Tenant updates the angle-bracket placeholder.)

4. Roles and responsibilities

(Tenant updates the named role-holders.)

5. Procedure

The IPC procedure operationalises the ten Code criteria across the service.

  1. IPC risk assessment. The IPC Lead maintains an IPC risk assessment for the service: service-user susceptibility (immunocompromised, elderly, paediatric, intoxicated), environmental risks (premises layout, ventilation, water systems), procedural risks (invasive procedures, aerosol-generating procedures, decontamination loads). Reviewed annually and on any change to service shape.
  2. Standard infection precautions. Hand hygiene per WHO 5 Moments; PPE per the procedure being performed; aseptic non-touch technique where appropriate; sharps handling per the safer-needles requirements; spillage management; environmental cleaning between patients per the decontamination matrix.
  3. Transmission-based precautions. Contact, droplet, and airborne precautions applied when a service user is known or suspected to have a transmissible infection. Isolation facilities used per the service's isolation protocol.
  4. Decontamination. Reusable medical devices are decontaminated per Health Technical Memorandum (HTM) 01-01 or equivalent (HTM 01-05 for dental). Decontamination cycles are traceable to the patient where the device was used. Single-use items are not reprocessed.
  5. Environmental cleaning, waste and laundry. A cleaning specification names what is cleaned, by whom, at what frequency, and with what product, and it accounts for the particular vulnerabilities and needs of the service-user bands the service supports rather than being a generic schedule. Daily, weekly, and deep-clean cycles are recorded. Clinical and non-clinical waste is segregated, stored, and disposed of safely under the waste regulations, including the safe handling of sharps. Laundry, including uniforms and service-user linen, is handled and decontaminated to prevent cross-infection.
  6. Antimicrobial stewardship. Prescribing follows the local antibiotic guidelines, the choice and duration are reviewed at 48 to 72 hours, the audit of antimicrobial use is run quarterly.
  7. Service-user and visitor information. Service users are given information about infections relevant to their care (post-procedure infection risk, signs of post-discharge infection, who to contact). Visitor restrictions during outbreaks are communicated clearly.
  8. Outbreak management. The IPC Lead declares an outbreak per the Code's threshold; the Outbreak Control Team meets with named attendees from clinical, IPC, management, and (where required) the local Health Protection Team; an outbreak log is maintained; a Reg 18 (Registration Regulations 2009) notification to CQC is filed where the threshold is met.
  9. Staff health and wellbeing. Staff with transmissible infections do not work until cleared; occupational-health referral is used where the role-fitness question is more complex; vaccination programmes (seasonal flu, COVID-19 where applicable, hepatitis B, MMR for relevant roles) are operated; and new workers, including those recruited from overseas, have their immunisation status screened and are offered the immunisations their role requires.
  10. IPC audit and surveillance. The IPC Lead runs the audit programme per Section 7 below and presents findings at the monthly clinical governance committee.
  11. Infection control in people's own homes (domiciliary and supported living). Where the service delivers care in people's own homes, staff assess the infection risks in each home, carry and use the hand-hygiene supplies and PPE they need where home facilities may be limited, handle and dispose of waste (including clinical waste and sharps) safely from the home, and apply standard precautions outside a clinical setting. Because the home is not an environment the service controls, the assessment is done for each home and reviewed.

6. Training requirement

Training records held in the tenant's training matrix register.

7. Audit

Compliance with this policy is monitored by the IPC Lead:

Audit findings recorded in the tenant's audit register; actions logged in the improvement-actions register.

8. Record-keeping

IPC records (audit findings, outbreak logs, decontamination traceability records, antimicrobial use audits, IPC risk assessments, staff health records, training records) are held in the tenant's IPC and clinical systems for a minimum of 8 years from the date of the last entry per the NHS Code of Practice on Records Management. Decontamination traceability records linking a sterilised device to the patient on whom it was used are retained per the patient record (NHS Code of Practice).

Verivius preserves the per-record audit trail indefinitely while the workspace is active.

9. Related policies in this pack

10. Sources and further reading

This template is based on CQC's guidance for providers and managers, the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, and other topic-specific legislation and guidance listed below. It is a starting point for adaptation, not a substitute for legal, clinical, HR, safeguarding or specialist professional advice.

11. When to seek further advice

Seek specialist advice where the issue involves serious harm, safeguarding, deprivation of liberty, restraint, children, professional misconduct, controlled drugs, radiation, termination of pregnancy, infection outbreak, water safety, employment dismissal, DBS barring referral, or regulatory enforcement.

12. Document control

Version Date Author Changes
v1 2026-05-19 Verivius (sample) Initial sample template.
v1.1 2026-06-01 Verivius (sample) Filled out Sections 3 to 8 with concrete content. Section 4 names the IPC Lead and Decontamination Lead roles. Section 5 expanded to a 10-step procedure covering IPC risk assessment, standard precautions, transmission-based precautions, decontamination, environmental cleaning, antimicrobial stewardship, service-user information, outbreak management, staff health, audit. Section 6 names training tiers (Level 1 to 3). Section 7 names the five audit cadences. Section 8 references the NHS Code of Practice on Records Management.
v1.2 2026-06-05 Verivius (sample) CQC content-checklist pass. Added waste segregation/disposal and laundry/uniform decontamination, and tied the cleaning specification to the service-user bands (CQC's red flag was generic schedules not accounting for the bands). Added overseas-worker immunisation screening to staff health. Added a new procedure step on infection control in people's own homes (domiciliary and supported living): per-home risk assessment, PPE/hand hygiene where facilities are limited, safe waste and sharps handling from the home, standard precautions outside a clinical setting. Updated stale related slugs.
v2 2026-06-10 Verivius (sample) Re-conformed to the current Verivius policy standard, preserving the original content. Re-anchored to Regulation 12 (safe care and treatment), in particular Reg 12(2)(h), with verbatim quotes drawn from the engaged CQC regulation and the plain-English summary taken from the /guidance manifest; retained the IPC Code of Practice as engaged guidance. Added the standard Sources and further reading and When to seek further advice blocks. No operational content was removed.

This sample policy template was issued by Verivius. It is a template, not a substitute for legal advice or the tenant's own policy-development process. Where this template and live law or regulator guidance diverge, the live source wins.

What good looks like here

Written from an ex-CQC inspector's chair, but the point is safe, well-led care your team can stand behind. Each row shows what strong evidence looks like, what thin evidence looks like, and where the expectation comes from.

Infection prevention is the policy where one unseen lapse hands a person an infection they did not walk in with: an instrument marked single-use put through a second patient, a decontamination cycle no one can trace, hands not cleaned between two people in the same room. None of it is visible to the person receiving care, and it stays invisible only while the system behind it is genuinely working. The traceability trail is what decides, months later, whether a reprocessing failure means writing to the handful of people actually exposed, or writing to everyone, or writing to no one because you cannot tell who was affected. In a service caring for immunocompromised, elderly or intoxicated people, an outbreak recognised and declared early is the difference between a contained cluster and widespread avoidable harm. Where care is delivered in someone's own home the service controls none of the environment, so the per-home assessment is the only thing standing between a single visit and a chain of transmission across a caseload. The evidence here is not for the inspection: it is the proof that the risks this particular service carries were thought about before somebody was harmed, not after.

  1. Cleaning intensity, products and contact time are matched to the vulnerabilities of the people the service supports and backed by completed cleaning records, so a person who is immunocompromised, elderly or intoxicated is not left in a room cleaned to a generic supplier schedule; a cleaning schedule that does not account for the service-user bands is a known CQC red flag.

    Strong evidence: The cleaning specification (what is cleaned, by whom, at what frequency, with what product, accounting for the service-user bands) and the quarterly environmental cleaning audit checking the specification against actual cleaning records.

    Weak evidence: A generic room-by-room schedule lifted from a supplier or another service, listing frequencies but with no line tying cleaning intensity, products or contact time to the specific susceptibilities of the people you support, for example immunocompromised, elderly or intoxicated service users. Cleaning records ticked in one pen at the end of the week, with no environmental cleaning audit comparing the specification against what was actually done.

    What the regulator expects to see. Not a law in itself, but CQC judges you against it, so an inspector will look for it and expect a reason where you depart from it.

  2. Where the service reprocesses reusable medical devices, each decontamination cycle is traceable to the patient the device was used on, so that after a reprocessing failure every patient exposed can be identified and followed up, and single-use items are never reprocessed; the failure is a decontamination process that exists but cannot be traced back to a named patient.

    Strong evidence: The decontamination cycle and traceability records (per Health Technical Memorandum 01-01, or 01-05 for dental) and the quarterly decontamination audit reviewing traceability records and washer disinfector and autoclave service records.

    Weak evidence: You can describe a decontamination process and show autoclave cycle printouts, but you cannot trace a given instrument set back to the named patient it was used on, so a recall after a reprocessing failure would be impossible. Items carrying the manufacturer's single-use symbol are quietly reprocessed and used again, and washer disinfector or autoclave service records are missing or out of date.

    The instructions from the maker of a product, device, or medicine. Following them is how the item is used safely, and for medical devices it is effectively expected.

  3. Hand hygiene is observed and audited in real practice, with dated sampled observations naming who was watched, at which moment, and whether they complied, rather than a policy statement and an annual training certificate standing in for it; what protects the person being treated is what happens at the sink, not what the policy says happens.

    Strong evidence: The monthly hand-hygiene audit of sampled observations across clinical staff, using the World Health Organization (WHO) 5 Moments framework or a locally-adapted observation tool.

    Weak evidence: The only evidence is the policy line saying staff follow the World Health Organization (WHO) 5 Moments, plus annual training certificates, with no dated observation sheets naming who was watched, at which moment, and whether they complied. Audits that report a flat 100 per cent every month read as a form filled in at the desk rather than someone standing in the clinical area watching real practice.

    The recognised standard from a professional or clinical body, such as NICE or a royal college. Not a legal duty, but the accepted mark of safe practice, and a departure needs a documented reason.

  4. A cluster of linked cases is recognised and declared against the Code threshold and logged, so the people using the service and their visitors are protected while it is running, and the separate statutory notification to CQC is filed where the threshold for notification is met; the failure is an outbreak handled informally, with staff sent home and nothing declared, logged or notified.

    Strong evidence: The outbreak log, the Outbreak Control Team record with named attendees, the declaration against the Code threshold, and the structured outbreak review after any outbreak; the separate statutory notification to CQC is filed where the threshold is met.

    Weak evidence: A cluster of linked cases would be handled informally and staff simply sent home, never declared against the Code threshold, so there is no outbreak log and no record of who sat on the Outbreak Control Team. The separate statutory notification to CQC, owed under the Care Quality Commission (Registration) Regulations 2009 where the threshold is met and distinct from any safeguarding referral, would be missed.

    What the regulator expects to see. Not a law in itself, but CQC judges you against it, so an inspector will look for it and expect a reason where you depart from it.

  5. Staff with a transmissible infection stay off work until they are cleared, so nobody receiving care is exposed by a colleague who came in with diarrhoea and vomiting or a respiratory infection, and immunisation status is screened and recorded for relevant roles, including workers recruited from overseas; the failure is leaving it to informal judgement, with nobody owning the fitness-to-work decision or the point of clearance to return.

    Strong evidence: The staff health records, the vaccination programme records (seasonal flu, hepatitis B, and measles, mumps and rubella (MMR) for relevant roles) and the overseas-worker immunisation screening evidence.

    Weak evidence: Immunisation status is blank or simply assumed for long-standing staff and for workers recruited from overseas, with no record of screening or of the vaccinations offered for the role. A staff member with diarrhoea and vomiting or a respiratory infection comes in and works because no one clearly owns the fitness-to-work decision or the point at which they are cleared to return.

    The recognised standard from a professional or clinical body, such as NICE or a royal college. Not a legal duty, but the accepted mark of safe practice, and a departure needs a documented reason.

  6. The infection prevention and control (IPC) risk assessment describes the service that actually exists, its people, premises and procedures, and is reviewed after any change to service shape, so the risks it controls are the ones the people using the service are genuinely exposed to; the failure is a template that could belong to any service, with a review date that has not moved after a new client group, an added treatment room or a change of premises.

    Strong evidence: The IPC risk assessment (service-user susceptibility, environmental risks, procedural risks) reviewed annually and on any change to service shape, and the annual IPC audit against the Code of Practice criteria.

    Weak evidence: A template IPC risk assessment that could belong to any service, listing generic hazards but nothing on your actual people, premises, water systems or the specific procedures you carry out. The review date has not moved even after the service took on a new client group, added a treatment room or changed premises, so it no longer describes the service that exists.

    A legal duty. This comes from legislation that applies to your service, so meeting it is not optional. The exact provision is cited beneath the badge.

    Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, reg 12(2)(h) (with reg 17(2)(b))

Related

Last verified 20 July 2026

Audit this policy

Infection prevention and control procedure checklist

A policy is the intent; the evidence is what a CQC inspector actually asks to see. This matching checklist turns the policy above into the records to keep, the audit to run, and the places small services most often fall short.

Open the Infection prevention and control procedure checklist

Spotted something to improve?

These are sample templates, not the last word. If you would change a wording, or want to help us confirm a detail, tell us and we will look at it.

Related Verivius content

Want help adapting this to your service?

A Verivius consultant can read your adapted policy against the live regulation and your service shape. The work fits inside a Mock Inspection engagement or a shorter consulting brief. A 20-minute conversation is the fastest way to find out whether the fit is right.

Get started free

Free to start, no card. A 14-day trial when you subscribe.

Last reviewed 10 June 2026